Git Pre-Commit Secrets and Entropy Scanner Engine

This script runs locally as a Git pre-commit hook, scanning staged file additions and modifications for exposed plaintext credentials and high-entropy strings. Internally, it executes git diff subprocess calls to capture modified chunks, running string tokens through regex matchers for API key structures alongside Shannon Entropy mathematical calculations to flag randomized secret strings.

Deploying this tool across developer Workstations and automated build environments prevents secrets from being committed into remote source control systems. It acts as a preventative safeguard against cloud credential compromises, supply chain leaks, and confidential key exposures at the initial development phase.

Overly sensitive entropy limits can generate frequent false positives on compiled assets, UUID strings, or lock files, interrupting developer workflow if path exclusion rules are missing. The hook must maintain execution speeds below one second to prevent developer friction, requiring binary file exclusions and strict processing boundaries.

> System.Execute()

import subprocess, re, math

def calculate_entropy(data):
    if not data:
        return 0
    entropy = 0
    for x in set(data):
        p_x = float(data.count(x)) / len(data)
        entropy -= p_x * math.log2(p_x)
    return entropy

def scan_staged_files():
    diff = subprocess.check_output(["git", "diff", "--cached", "-U0"], text=True)
    patterns = [re.compile(r'AKIA[0-9A-Z]{16}'), re.compile(r'([^a-zA-Z0-9]+|^)sk_live_[0-9a-zA-Z]{24}')]
    
    for line in diff.splitlines():
        if line.startswith("+") and not line.startswith("+++"):
            for pattern in patterns:
                if pattern.search(line):
                    print(f"[CRITICAL] Regex Secret Match Found: {line}")
            tokens = line[1:].split()
            for token in tokens:
                if len(token) > 20 and calculate_entropy(token) > 4.5:
                    print(f"[WARNING] High Entropy Token Detected ({token[:10]}...): {line}")

scan_staged_files()

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-5026BD2A69FF